An insurance company in North Carolina wants to disclose an applicant's personal information gathered during underwriting to an unrelated marketing company. Under the Insurance Information and Privacy Protection Act, when may the insurer disclose the information?

Why C is correct

Under the North Carolina Insurance Information and Privacy Protection Act, Article 39 of Chapter 58 (G.S. 58-39-5 through 58-39-120), an insurer may disclose an individual's personal information only with the individual's authorization or as otherwise permitted by the Act, and the individual has rights to access and correct the information maintained about them. Marketing to a third party is not among the permitted uses absent authorization, so the applicant's consent controls.

Why the other options are wrong

• A) The Act does not confine disclosures to regulators; with proper authorization or another permitted basis under G.S. 58-39-5 through 58-39-120, other disclosures are possible.
• B) Collection for a business purpose does not authorize unlimited sharing; disclosure requires authorization or a permitted basis under the Act.
• D) Disclosure is not flatly banned forever; the Act permits disclosure with the individual's authorization or where otherwise allowed by G.S. 58-39-5 through 58-39-120.

Memory hook

Your data, your signature: no authorization, no disclosure.